topic Re: LDAP adminGroups configuration problem in Alfresco Archive

LDAP adminGroups configuration problem

jim676 — Fri, 14 Feb 2014 15:40:57 GMT

Hi,Quick question I have configured the explorer to work with LDAP, it all works well except I cannot create an admin user, i.e a user who has access to everthing in the explorer. I work in a large organization and I am not allowed the LDAP admin role, thus I though the 'property name="adminGroups"‍

Re: LDAP adminGroups configuration problem

alim736 — Fri, 14 Feb 2014 17:16:12 GMT

I face same problem

Re: LDAP adminGroups configuration problem

jbarrez — Mon, 17 Feb 2014 14:28:09 GMT

You need to change the

<code>
<property name="loginHandler" ref="activitiLoginHandler" />
</code>

to not use activitiLoginHandler, but a CUSTOM bean that implements the org.activiti.explorer.ui.login.LoginHandler interface.

It is the default implementation that has a hard dependency on the 'admin' group

<code>
   if (Constants.SECURITY_ROLE_ADMIN.equals(group.getId())) {
       loggedInUser.setAdmin(true);
   }
</code>

Re: LDAP adminGroups configuration problem

b_schnarr — Tue, 04 Mar 2014 17:14:57 GMT

If those values are hardcoded, why does the user guide says: Add following configuration to the explorerApp bean in activiti-ui.context:
<code>
<property name="adminGroups">
<list>
    <value>admin</value>
</list>
</property>
<property name="userGroups">
    <list>
      <value>user</value>
    </list>
</property>
</code>

This is not necessary, when those values are hardcoded, isn´t it?

Re: LDAP adminGroups configuration problem

b_schnarr — Thu, 06 Mar 2014 14:24:45 GMT

I tried to extend the Activiti Explorer to have a "designer" security role, so that you can write
<code>
<property name="adminGroups">
<list>
    <value>activiti_admins</value>
</list>
</property>
<property name="userGroups">
    <list>
      <value>activiti_users</value>
    </list>
</property>
<property name="designerGroups">
<list>
    <value>activiti_designers</value>
</list>
</property>
</code>

Therfore, I added in ExplorerApp.java:

<code>protected List<String> designerGroups;</code>

and

<code>
public List<String> getDesignerGroups() {
return designerGroups;
}

public void setDesignerGroups(List<String> designerGroups) {
    this.designerGroups = designerGroups;
}
</code>

In addition, the DefaultLoginHander looks like this:

<code>
for (Group group : groups) {

        if (Constants.SECURITY_ROLE.equals(group.getType())) {
          loggedInUser.addSecurityRoleGroup(group);
          if (ExplorerApp.get().getUserGroup().equals(group.getId())) {
            loggedInUser.setUser(true);
          }
          if (ExplorerApp.get().getAdminGroup().equals(group.getId())) {
            loggedInUser.setAdmin(true);
          }
          if (ExplorerApp.get().getDesignerGroup().equals(group.getId())) {
              loggedInUser.setDesigner(true);
            }
</code>

Without LDAP, this worked very fine. But as soon as I switched to LDAP, my Explorer just considers the admin and the user role.
Maybe, this here is the reason:
<code>if (Constants.SECURITY_ROLE.equals(group.getType())) { </code>
Maybe, the Explorer sees the LDAP Group "activiti_designers" not as a security group. But with the two other roles (users and admins), it works fine.
In short: When using LDAP, how does the Activiti Explorer know that user and admin are security role groups?

Did I miss something?

Re: LDAP adminGroups configuration problem

b_schnarr — Sun, 09 Mar 2014 16:52:01 GMT

That was it. The Activiti Explorer did not know that the LDAP group activiti_designers is a security role. I fixed this with this line:
<code> if (Constants.SECURITY_ROLE.equals(group.getType()) || ExplorerApp.get().getDesignerGroup().equals(group.getId()))</code>

Re: LDAP adminGroups configuration problem

jbarrez — Mon, 10 Mar 2014 10:59:16 GMT

Thanks for posting this back, this will help a lot of people!

Re: LDAP adminGroups configuration problem

nrocchetti — Wed, 28 May 2014 18:04:14 GMT

Hi,

I am a begginer on Activiti.

I'm trying to get activiti to recognize the groups I set on ldap.
Reading on this post I understand that what is said on the user-guide doesn't work.

Next is what it is said on the user-guide to get activiti to recognize ldap groups:
<property name="adminGroups">
<list>
    <value>Admin</value>
</list>
</property>
<property name="userGroups">
    <list>
      <value>User</value>
    </list>
</property>
</bean>

If this doesn't work, would you explain how can I get activiti to recognize my custom bean that implements LoginHandler interface?

Thanks!